CISA Says More Than 100 Internet-Exposed Water Systems Targeted in July
Summary
CISA says malicious activity targeted over 100 internet-exposed water and wastewater systems in July 2026, often PLCs connected to cellular modems. It recommends reducing exposure and securing necessary remote access; the attacks caused no significant disruption.
Key points
- CISA observed malicious activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems sector in July 2026.
- The activity commonly targeted programmable logic controllers connected directly to cellular modems.
- The attacks were linked to Iranian threat actors and sought to disrupt operational technology systems.
- At least 12 states may have been affected; Minnesota, Michigan, South Dakota, Georgia, New Jersey, and Alabama confirmed targeting.
- The attacks caused no significant disruption, according to the article.
- CISA advises inventorying internet-accessible systems and removing or restricting exposures that are not operationally necessary.
- For systems that must remain online, CISA recommends changing default passwords, applying updates, securing remote access, using multifactor authentication, and monitoring traffic.
Article Details
- Event Type
- Cyberattacks targeting internet-exposed water and wastewater systems
- Impact
- CISA reported malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems Sector in July 2026, commonly involving PLCs connected directly to cellular modems. The attacks sought to disrupt operational technology systems but caused no significant disruption. At least 12 states appear to have been affected; the article says the full number and locations were not known.